iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

2
votes
1answer
2k views

Forwarding packets from loopback interface with policy-based routing

I have the following iptables rule: iptables -t mangle -A PREROUTING -p udp -m udp --dport 10000 -j MARK --set-xmark 0x4/0xffffffff which sets fwmark 4 on all udp packets with destination port ...
1
vote
2answers
2k views

ping: unknown host with iptables enabled

I can't ping www.google.com. However I can ping the IP address: ping 74.125.237.142 At first, I thought it is a problem with my DNS settings. But I checked my resolv.conf, hosts, and hostname ...
1
vote
0answers
259 views

Iptables and --tcp-flags

If I have the following rule in the nat-table in the prerouting chain: 0 0 REDIRECT tcp -- eth5 any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN redir ports ...
6
votes
2answers
6k views

Tunnel yum traffic through another server via ssh

I am running a Fedora desktop behind a corporate proxy that is blocking yum traffic (specifically *.gz and *.bz2). I have access to a separate RedHat machine via ssh which can download anything it ...
3
votes
0answers
867 views

Forward multicast between two LAN segments (Chromecast)

I've found some rules but most are inconclusive. Chromecast uses DIAL and discovers via multicast from what I've understood.. I have an Ethernet-connected computer which I would like to route via my ...
2
votes
1answer
82 views

Is iptables -p proto -m proto redundant?

I keep seeing "-p tcp -m tcp" all over the place, but it looks redundant. Why the '-m' if the '-p' already matches the protocol?
1
vote
1answer
139 views

How to map IP by iptables ?

I create a network namespace In this namespace, I open a nginx So for now, I can visit web server by 172.17.0.2 What I want to do is mapping this IP to 127.0.0.1 Lets say if I visit 127.0.0.1, I ...
0
votes
0answers
335 views

Iptables and Ip6tables redirect traffic

I want to deny all the network traffic and just allow a few ports and redirect them through tor or the socket I have set in /etc/tor/torrc, where tor binds to. And I am currently setting up these ...
1
vote
0answers
60 views

How do I write the rule that has an edge server forward a clients request to an internal network server and back?

I have a network situation as follows: -server1:1.1.1.1 -server2:2.2.2.2 -tunnel 10.8.0.0/24 -client: 3.3.3.3 I'm trying to have client IP 3.3.3.3 do an HTTP request from the 1.1.1.1 server. ...
2
votes
1answer
3k views

iptables routing incoming IP to another destination IP question

I have a test setup: server1:1.1.1.1 server2:2.2.2.2 client: 3.3.3.3 I'm trying to have client IP 3.3.3.3 do a HTTP request from the 1.1.1.1 server. However I want the 1.1.1.1 server to pass this ...
1
vote
1answer
45 views

Does -o and -i make sense when the target host is already connected to the interface specified?

iptables -A FORWARD -s 192.168.20.7 -d 10.10.48.3 -p tcp --dport 25 -o eth1 -j ACCEPT iptables -A FORWARD -s 10.10.48.3 -d 192.168.20.7 -p tcp --sport 25 -i eth1 -j ACCEPT Tuning the firewall of my ...
6
votes
2answers
294 views

Setting traffic class on return packets

I have a network topology: Server <-> router1 <-> router2 <-> router3 <-> edgeRouter <-> "internet" All routers are linux based, and support iptables. The server sets ...
0
votes
1answer
495 views

Route OpenVPN clients to another different OpenVPN server

I have this scenario.. Server(Primary) with a multiple OpenVPN connections (so server is connected as a client to multiple OpenVPN servers.. lets say secondary servers) This server runs OpenVPN ...
1
vote
2answers
675 views

Drop TCP packets and prevent TCP retransmission

I have an application that sends TCP data to a server. My server is made to intentionally drop the packets sent by the application, and as a result the client retransmits the packets. I need to ...
3
votes
2answers
187 views

How can I determine what program or user connected to a particular port after the fact?

I am examining the egress IPTABLES log of my computer for yesterday and notice the following: IN= OUT=eth0 SRC=192.168.1.1 DST=69.46.36.10 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=12345 DF PROTO=TCP ...
1
vote
1answer
2k views

iptables to allow teamviewer

I'm having some trouble to allow TeamViewer in a restrictive iptables configuration. I'm running Fedora 20. After some research I found out TeamViewer uses ports 80, 443 and I have created this ...
2
votes
0answers
1k views

How do I route bittorrent through a second interface?

I've managed to configure openvpn on my DD-WRT router such that the tunnel is up and working, but that it doesn't mess with routes at all (the default configuration wants all traffic to go through ...
3
votes
1answer
375 views

IP rule table look up does not seem to work

I have a sytem with three network interfaces. Below is the configuration that I'm trying to set up. wlan0 (its actually an WiFi AP interface) - other devices connects via this interface. net1 - ...
2
votes
1answer
234 views

psad: do not block access to HTTP

I want to block intruders via psad, but HTTP and HTTPS should not be blocked. For example, if someone is scanning my dedicated server via nmap, psad should block him for 2 hours, but he should still ...
-1
votes
1answer
211 views

How to use partial IP address in /etc/sysconfig/iptables for the “-s” flag?

in this example it is a full ip ip is: 1.1.1.1 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -s 1.1.1.1 -j ACCEPT but suppose i want to allow any ip that simply starts with: 1.1. ...
0
votes
1answer
2k views

iptables redirect traffic from VPN interface to next interface

Can you help me with this problem please? I need redirect all traffic from tun0 interface (OpenVPN tunnel) to eth1 interface. eth1 is internal network behind this system which works as special ...
4
votes
2answers
746 views

Redirecting loopback traffic through a router

For some tests purposes, I am running multiple socket-based applications on one machine and want to simulate "real" network conditions between them. I thought the simplest would be to redirect all ...
1
vote
3answers
4k views

Redirect domains to different ports on same machine

I used the following command to redirect 80 to 3000. All the requests that come, from any domain, are redirected to 3000: sudo iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-port ...
-2
votes
2answers
900 views

Domain Name problems in CentOS hosted under VirtualBox

When I ping www.google.com I get: [root@ryanPC ~]# ping www.google.com ping: unknown host www.google.com Also, when I run ping -n 8.8.8.8, I get: connect: Network is unreachable So I have ran the ...
1
vote
1answer
151 views

iptables routing

I believe this question has been answered a 100 times before, but I'm almost sure that I'm searching into the wrong direction. My desired setup is the following: I have a virtual host using KVM and ...
5
votes
3answers
11k views

bash: iptables: command not found

How do I fix the iptables: command not found problem that happened to Debian 7.6? batman@gotham:~$ uname -a Linux gotham 3.14-0.bpo.2-amd64 #1 SMP Debian 3.14.13-2~bpo70+1 (2014-07-31) x86_64 ...
3
votes
3answers
9k views

How can I make iptables service start automatically after reboot on CenOS/RHEL7?

I am having a few issues with a newly installed home server I am preparing. I have installed CentOS7 on it and I found that port 80 and 443 are off by default. I therefore added them to the iptables ...
2
votes
2answers
370 views

Delay when iptables icmp rules take effect

I have setup my iptables to disable all incoming connection, i.e. :INPUT DROP [0:65535] When the iptables has been started, I run the following command to enable ping: /usr/sbin/iptables -A INPUT ...
4
votes
1answer
1k views

Proper way to handle FTP over SSL with restrictive firewall rules?

Without SSL, FTP works fine over a stateful Firewall, like netfilter (iptables) + the nf_conntrack_ftp kernel module like this: # modprobe nf_conntrack_ftp # iptables -A INPUT -m conntrack --ctstate ...
2
votes
1answer
373 views

How is whonix blocking UDP traffic (except udp-dns related traffic)?

I want to know how whonix manages to block unwanted UDP-Traffic i.e. all UDP-traffic but DNS related udp traffic. I looked at the iptable rules both in the Workstation and Gateway. There are no ...
2
votes
0answers
414 views

iptables rule to transfer UDP through a SSH tunnel

The problem I have two programs that runs on two distant computers and communicate through a specific protocol. All I know is that this protocol only communicates through UDP and uses the ports 1101 ...
0
votes
0answers
1k views

Upon bootup, all iptables are lost because the kernel module ip_set is not loaded

i can get iptables to whitelist / blacklist using ipset members, but after a reboot, the iptables are emptied out because the kernel module is not loaded. Have limped along in the past by customizing ...
0
votes
1answer
92 views

how to find out which chain in iptables in listing

Suppose I have the following two entries line of iptables: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -A INPUT -s 192.168.1.0/24 -j DROP So, I have POSTROUTING and INPUT chains. ...
11
votes
1answer
8k views

Configuring OpenVPN to use Firewalld instead of iptables on Centos 7

I need some help configuring OpenVPN on Centos 7 using firewalld. I used iptables on Centos 6.5 and only had to add the following lines to /etc/sysconfig/iptables: -A POSTROUTING -s "10.0.0.0/24" ...
1
vote
1answer
68 views

Confused by different output from iptables -L

I keep following this tutorial using a bash shell on ubuntu 12.04 as I open more and more ports on my server. I usually open up ports like this sudo iptables -A INPUT -p tcp --dport PortNumberToOpen ...
0
votes
1answer
57 views

What this Iptables rules does?

I think I can understand this iptable rule, but I want to make sure what it does, so can someone explain to me technically what this does? well this two rules combined. /sbin/iptables -t nat -A ...
2
votes
0answers
63 views

Extra overhead in MASQUERADE target

There's a part in iptables manual concerning SNAT and MASQUERADE targets. I know the key difference between the two, but I don't fully get the following sentence: It is still possible to use the ...
4
votes
1answer
360 views

IPTables rules for specific processes [duplicate]

I have a lot more experience with the Windows Firewall with advanced functionality than I do with IPTables. With the WFAF, I was able to lock down a program so that it could only connect over specific ...
3
votes
1answer
53 views

Which network services depend on the “accept related input” iptables rule?

Background I am setting up a firewall for a webserver and was wondering if it would be a good security meassure to even reject RELATED input traffic and only except established connections by ...
-1
votes
1answer
296 views

MYSQL : Connecting to mysql from : 127.0.0.1 + telling ip tables to allow only 127.0.0.1 for mysql port : Logic vs Common Sense

If i make 1 billion or 1 trillion queries to MYSQL database from 127.0.0.1 via port 3306. vs If i make same amount of queries to MYSQL database also from 127.0.0.1 via port 3306. but with ...
9
votes
3answers
8k views

Move iptables rule (w/o removing and adding)

Is there a way to move a rule in the iptables and change it position ? I'm aware i can use -I to insert a rule in a specific position, but i also like to keep the counters.
2
votes
0answers
52 views

How can I configure iptables for per application setup?

I am working on a project where we are building lots of micro-services. Each service is neatly packaged as an RPM. Ideally I'd like for us to have iptables enabled on all of our machines and it would ...
1
vote
1answer
1k views

Curious about strange ICMP type 3 code 10 traffic to my IP address

My firewall (iptables) logs some strange ICMP type 3 code 10 traffic that I am curious to understand (specifically how or if this could be an exploit of some sort). Type 3 = Destination ...
1
vote
0answers
251 views

Forward local port to remote port in a Vagrant machine

I have MySQL running on my local machine and I need to publish this port to a Vagrant box without any special SSH hackery. Is there a way for me to forward 10.0.2.2:3306 to 127.0.0.1:3306 on the ...
21
votes
3answers
64k views

How to ensure SSH port is only open to a specific IP address?

This is my /etc/sysconfig/iptables: It has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. ...
2
votes
1answer
1k views

Unable to access website hosted on virtual machine

I'm on a mac (osx 10.9.3) running CentOS7 in virtualbox. I would like to access the website hosted on the virtual machine. Browsing to the Guest IP returns webpage not available. I'm able to ping and ...
3
votes
0answers
552 views

iptables hangs at applying rules

I have a set of rules that are supposed to give me the most protection before things like fail2ban and other things are added to the mix. The issue is that although everything checks out in the test, ...
0
votes
1answer
87 views

how to get effect of IP rules script in RHEL 6?

I have written one ip.sh file in that I have written one rule and then saved the iprules with the corresponding commands. Now when I opened /etc/sysconfig/iptables nothing is reflecting. I need the ...
1
vote
0answers
107 views

ISC DHCP Server - A Client's Uplink Is Not Working

Running a DHCP server, client(s) does not have up-link (0Mbps) and has a downlink (50Mbps.) I am setting up a gateway/router on a PC running Debian Wheezy with ISC-DHCP. I have 1 WAN (eth0) and 2 LAN ...
4
votes
0answers
441 views

iptables rule no actions on scapy packets

I wrote this rule to change all udp destination IP addresses to 8.8.8.8 when dport is 53: iptables -t nat -A OUTPUT -p udp -m udp --dport 53 -j DNAT --to-destination 8.8.8.8 The rule worked when ...